lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 29 Oct 2022 21:09:56 +0800 From: menglong8.dong@...il.com To: edumazet@...gle.com, kuba@...nel.org Cc: davem@...emloft.net, pabeni@...hat.com, yoshfuji@...ux-ipv6.org, dsahern@...nel.org, imagedong@...cent.com, kafai@...com, asml.silence@...il.com, keescook@...omium.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org Subject: [PATCH net-next 8/9] net: tcp: store drop reasons in route_req From: Menglong Dong <imagedong@...cent.com> Add skb drop reasons to tcp_v4_route_req() and tcp_v6_route_req(). And the new reason SKB_DROP_REASON_LSM is added, which is used when skb is dropped by LSM. Signed-off-by: Menglong Dong <imagedong@...cent.com> --- include/net/dropreason.h | 5 +++++ net/ipv4/tcp_ipv4.c | 11 +++++++++-- net/ipv6/tcp_ipv6.c | 11 +++++++++-- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/include/net/dropreason.h b/include/net/dropreason.h index 364811bce63f..a5de00d02213 100644 --- a/include/net/dropreason.h +++ b/include/net/dropreason.h @@ -74,6 +74,7 @@ FN(TCP_REQQFULLDROP) \ FN(TCP_ABORTONDATA) \ FN(TCP_ABORTONLINGER) \ + FN(LSM) \ FNe(MAX) /** @@ -336,6 +337,10 @@ enum skb_drop_reason { * LINUX_MIB_TCPABORTONLINGER */ SKB_DROP_REASON_TCP_ABORTONLINGER, + /** + * @SKB_DROP_REASON_LSM: dropped by LSM + */ + SKB_DROP_REASON_LSM, /** * @SKB_DROP_REASON_MAX: the maximum of drop reason, which shouldn't be * used as a real 'reason' diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index a85bc7483c5a..8fdea8e6207f 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1447,12 +1447,19 @@ static struct dst_entry *tcp_v4_route_req(const struct sock *sk, struct flowi *fl, struct request_sock *req) { + struct dst_entry *dst; + tcp_v4_init_req(req, sk, skb); - if (security_inet_conn_request(sk, skb, req)) + if (security_inet_conn_request(sk, skb, req)) { + TCP_SKB_DR(skb, LSM); return NULL; + } - return inet_csk_route_req(sk, &fl->u.ip4, req); + dst = inet_csk_route_req(sk, &fl->u.ip4, req); + if (!dst) + TCP_SKB_DR(skb, IP_OUTNOROUTES); + return dst; } struct request_sock_ops tcp_request_sock_ops __read_mostly = { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 2c2048832714..44c4aa2789d6 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -823,12 +823,19 @@ static struct dst_entry *tcp_v6_route_req(const struct sock *sk, struct flowi *fl, struct request_sock *req) { + struct dst_entry *dst; + tcp_v6_init_req(req, sk, skb); - if (security_inet_conn_request(sk, skb, req)) + if (security_inet_conn_request(sk, skb, req)) { + TCP_SKB_DR(skb, LSM); return NULL; + } - return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP); + dst = inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP); + if (!dst) + TCP_SKB_DR(skb, IP_OUTNOROUTES); + return dst; } struct request_sock_ops tcp6_request_sock_ops __read_mostly = { -- 2.37.2
Powered by blists - more mailing lists